What actually happens on 1 July 2026
A common misreading first: CPS 230 is not commencing on 1 July 2026. The standard commenced on 1 July 2025. What expires in three weeks is the last transitional relief. APRA gave regulated entities until the earlier of the next contract renewal or 1 July 2026 to bring pre-existing arrangements with material service providers into line with the standard. From 1 July, there is no legacy category left: every material arrangement, however old the paper, must meet CPS 230 requirements.
The same day, the final targeted amendments APRA released on 30 April 2026 commence. These amend CPS 230, the practice guide CPG 230 and the Material Service Provider Register template, and introduce a limited exemption from specified contractual requirements for material arrangements with certain non-traditional providers, such as central banks, payment schemes and clearing facilities, where negotiating bespoke terms is not practicable. The exemption is narrow: every other obligation, including the register, risk management and business continuity planning, still applies to those arrangements.
Who is caught
All APRA-regulated entities: banks and ADIs, insurers across life, general and private health, and superannuation trustees. Material service providers themselves are not APRA-regulated, but they feel the standard contractually, and law firms advising on the uplift have been blunt that providers who fail to engage risk losing the business to competitors who will sign the required terms.
Where AI sits in this
The materiality test is technology-neutral: a provider is material if the entity relies on it to undertake a critical operation, or if the arrangement exposes the entity to material operational risk. By mid-2026 that description fits a growing share of AI arrangements: document and claims processing models, credit decisioning components, fraud and AML screening, customer service platforms with embedded AI, and the cloud and model providers underneath them.
Two AI-specific traps are worth naming. First, the fourth-party problem: when your vendor's product is built on a foundation model provider, the dependency that can actually fail sits one layer below your contract. Subcontracting notification, continuity obligations, audit and access rights and exit planning need to reach that layer, and practitioner guidance on the deadline stresses that legacy contracting cycles can no longer be used to defer that remediation. Second, scenario analysis: model degradation, provider outage and the sudden withdrawal of an AI service are operational risk scenarios in their own right, and tolerance levels for critical operations should reflect them. Our standing explainer, APRA CPS 230 and AI, covers the framework in depth.
The three-week checklist
1. Reconcile the register. Confirm the MSP register reflects reality, including AI arrangements adopted since the last submission, and prepare for the updated APRA Connect return. 2. Close out contract uplift. For each material arrangement, confirm CPS 230 terms are executed, in signing, or formally documented as exempt under the 30 April amendments. 3. Document exemption reliance. Where the non-traditional provider exemption is used, record the basis and how the residual obligations are met. 4. Map AI fourth parties. For each AI-enabled service in a critical operation, identify the underlying model and infrastructure providers and confirm the contract reaches them. 5. Align tolerances and continuity plans. Check that business continuity plans and tolerance levels reflect AI dependencies and have been tested against an AI-failure scenario. 6. Brief the board. The board owns operational risk oversight under CPS 230; give it a one-page status of what is compliant, what is exempt and what remains open past 1 July.
If the date is missed
There is no grace period after the grace period. An arrangement that is neither uplifted nor documented as exempt on 1 July is a live compliance gap on a register APRA collects, and supervisors have signalled that operational resilience remains a priority area. The practical cost of being early is small; the supervisory cost of being late is not.
Sources
APRA, Operational Risk Management (CPS 230 hub, 30 April 2026 amendments) · APRA, Response paper: Operational Risk Management (transition arrangements) · McCullough Robertson, CPS 230 compliance countdown (May 2026) · Dwyer Harris, CPS 230 and material service providers (May 2026). General information, not legal advice; verify against the prudential standard and your own advisers.